chore: import upstream snapshot with attribution

2026-07-13 13:12:00 +08:00
commit 3de48288cb
2986 changed files with 1131193 additions and 0 deletions
@@ -0,0 +1,313 @@
+"""Tests for the native OpenCode bridge state helpers."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+import pytest
+
+from omnigent import opencode_native_bridge as bridge
+from omnigent.opencode_native_bridge import (
+    OpenCodeNativeBridgeState,
+    auth_headers_for_secret,
+    bridge_dir_for_bridge_id,
+    build_opencode_native_spawn_env,
+    clear_bridge_state,
+    ensure_auth_secret,
+    prepare_bridge_dir,
+    read_bridge_state,
+    update_active_message_id,
+    update_last_event_id,
+    update_model_override,
+    user_opencode_config_path,
+    write_bridge_state,
+    write_cost_popup_config,
+    write_opencode_policy_plugin,
+    write_relay_bridge_config,
+    xdg_config_home_for_bridge_dir,
+    xdg_data_home_for_bridge_dir,
+)
+
+
+@pytest.fixture
+def bridge_dir(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """Isolated bridge directory rooted under a tmp path."""
+    monkeypatch.setattr(bridge, "_BRIDGE_ROOT", tmp_path / "opencode-native")
+    return prepare_bridge_dir("bridge_test")
+
+
+def _state(bridge_dir: Path, **overrides: object) -> OpenCodeNativeBridgeState:
+    base = {
+        "session_id": "conv_abc",
+        "server_base_url": "http://127.0.0.1:49231",
+        "opencode_session_id": "ses_abc",
+        "auth_secret": "s3cret",
+        "xdg_data_home": str(xdg_data_home_for_bridge_dir(bridge_dir)),
+        "xdg_config_home": str(xdg_config_home_for_bridge_dir(bridge_dir)),
+    }
+    base.update(overrides)
+    return OpenCodeNativeBridgeState(**base)  # type: ignore[arg-type]
+
+
+def test_prepare_bridge_dir_creates_xdg_roots(bridge_dir: Path) -> None:
+    assert bridge_dir.is_dir()
+    assert xdg_data_home_for_bridge_dir(bridge_dir).is_dir()
+    assert xdg_config_home_for_bridge_dir(bridge_dir).is_dir()
+    # 0700 perms on the bridge dir.
+    assert (os.stat(bridge_dir).st_mode & 0o777) == 0o700
+
+
+def test_write_read_state_round_trips(bridge_dir: Path) -> None:
+    write_bridge_state(bridge_dir, _state(bridge_dir, model_override="anthropic/claude-opus-4"))
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.session_id == "conv_abc"
+    assert loaded.opencode_session_id == "ses_abc"
+    assert loaded.server_base_url == "http://127.0.0.1:49231"
+    assert loaded.auth_secret == "s3cret"
+    assert loaded.model_override == "anthropic/claude-opus-4"
+    assert loaded.status == "idle"
+
+
+def test_read_missing_state_is_none(bridge_dir: Path) -> None:
+    assert read_bridge_state(bridge_dir) is None
+
+
+def test_read_corrupt_state_is_none(bridge_dir: Path) -> None:
+    (bridge_dir / "state.json").write_text("{not json", encoding="utf-8")
+    assert read_bridge_state(bridge_dir) is None
+
+
+def test_read_incomplete_state_is_none(bridge_dir: Path) -> None:
+    (bridge_dir / "state.json").write_text(json.dumps({"session_id": "x"}), encoding="utf-8")
+    assert read_bridge_state(bridge_dir) is None
+
+
+def test_clear_state_removes_file(bridge_dir: Path) -> None:
+    write_bridge_state(bridge_dir, _state(bridge_dir))
+    clear_bridge_state(bridge_dir)
+    assert read_bridge_state(bridge_dir) is None
+    # Idempotent.
+    clear_bridge_state(bridge_dir)
+
+
+def test_update_active_message_id(bridge_dir: Path) -> None:
+    write_bridge_state(bridge_dir, _state(bridge_dir))
+    update_active_message_id(bridge_dir, "msg_1", status="busy")
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.active_message_id == "msg_1"
+    assert loaded.status == "busy"
+    update_active_message_id(bridge_dir, None, status="idle")
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.active_message_id is None
+    assert loaded.status == "idle"
+
+
+def test_update_model_override(bridge_dir: Path) -> None:
+    write_bridge_state(bridge_dir, _state(bridge_dir))
+    assert update_model_override(bridge_dir, "anthropic/claude-opus-4") is True
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.model_override == "anthropic/claude-opus-4"
+    # Blank clears the override.
+    assert update_model_override(bridge_dir, "  ") is True
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.model_override is None
+
+
+def test_update_model_override_no_state_returns_false(bridge_dir: Path) -> None:
+    # No bridge state written yet (server not launched).
+    assert update_model_override(bridge_dir, "x/y") is False
+
+
+def test_write_relay_bridge_config_writes_token_and_is_idempotent(bridge_dir: Path) -> None:
+    write_relay_bridge_config(bridge_dir)
+    config_path = bridge_dir / "bridge.json"
+    assert config_path.exists()
+    payload = json.loads(config_path.read_text())
+    token = payload["token"]
+    assert isinstance(token, str) and token
+    # Idempotent: a second call must NOT rotate the token (the relay HTTP server
+    # may already have been started with it).
+    write_relay_bridge_config(bridge_dir)
+    assert json.loads(config_path.read_text())["token"] == token
+
+
+def test_write_cost_popup_config_writes_ap_routing(bridge_dir: Path) -> None:
+    path = write_cost_popup_config(
+        bridge_dir,
+        ap_server_url="http://127.0.0.1:6767",
+        ap_auth_headers={"Authorization": "Bearer tok"},
+    )
+    payload = json.loads(path.read_text())
+    assert payload == {
+        "ap_server_url": "http://127.0.0.1:6767",
+        "ap_auth_headers": {"Authorization": "Bearer tok"},
+    }
+    # Rewritten (not skipped) so a later checkpoint gets a fresh token.
+    write_cost_popup_config(bridge_dir, ap_server_url="http://h:1", ap_auth_headers={})
+    assert json.loads(path.read_text()) == {"ap_server_url": "http://h:1", "ap_auth_headers": {}}
+
+
+def test_write_opencode_policy_plugin(bridge_dir: Path) -> None:
+    path = write_opencode_policy_plugin(bridge_dir)
+    assert path.name == "omnigent-policy.js"
+    src = path.read_text(encoding="utf-8")
+    # The two phase hooks the reactive permission path can't reach.
+    assert '"chat.message"' in src  # REQUEST phase
+    assert '"tool.execute.after"' in src  # TOOL_RESULT phase
+    # Posts the proto phases + reads its coordinates from env.
+    assert "PHASE_REQUEST" in src and "PHASE_TOOL_RESULT" in src
+    assert "OMNIGENT_POLICY_URL" in src and "OMNIGENT_SESSION_ID" in src
+    assert "/policies/evaluate" in src
+    # A function export so opencode's Object.values(mod) loader picks it up.
+    assert "export const OmnigentPolicyPlugin" in src
+    # Idempotent overwrite (re-launch ships fresh code, no error).
+    assert write_opencode_policy_plugin(bridge_dir) == path
+
+
+def test_update_last_event_id(bridge_dir: Path) -> None:
+    write_bridge_state(bridge_dir, _state(bridge_dir))
+    update_last_event_id(bridge_dir, "evt_42")
+    loaded = read_bridge_state(bridge_dir)
+    assert loaded is not None
+    assert loaded.last_event_id == "evt_42"
+
+
+def test_ensure_auth_secret_is_stable_and_0600(bridge_dir: Path) -> None:
+    secret = ensure_auth_secret(bridge_dir)
+    assert secret
+    # Same secret on a second call (reused across server restarts).
+    assert ensure_auth_secret(bridge_dir) == secret
+    path = bridge_dir / "auth.secret"
+    assert (os.stat(path).st_mode & 0o777) == 0o600
+
+
+def test_auth_headers_for_secret() -> None:
+    assert auth_headers_for_secret(None) == {}
+    headers = auth_headers_for_secret("pw")
+    assert headers["Authorization"].startswith("Basic ")
+    import base64
+
+    decoded = base64.b64decode(headers["Authorization"].split(" ", 1)[1]).decode()
+    assert decoded == "opencode:pw"
+
+
+def test_state_auth_headers_method(bridge_dir: Path) -> None:
+    state = _state(bridge_dir, auth_secret="pw")
+    assert state.auth_headers()["Authorization"].startswith("Basic ")
+
+
+def test_spawn_env_points_at_bridge_dir(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(bridge, "_BRIDGE_ROOT", tmp_path / "opencode-native")
+    env = build_opencode_native_spawn_env("conv_abc")
+    assert env["HARNESS_OPENCODE_NATIVE_BRIDGE_DIR"] == str(bridge_dir_for_bridge_id("conv_abc"))
+    assert env["HARNESS_OPENCODE_NATIVE_REQUEST_SESSION_ID"] == "conv_abc"
+
+
+def test_spawn_env_bridge_id_override(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(bridge, "_BRIDGE_ROOT", tmp_path / "opencode-native")
+    env = build_opencode_native_spawn_env("conv_abc", bridge_id="bridge_xyz")
+    assert env["HARNESS_OPENCODE_NATIVE_BRIDGE_DIR"] == str(bridge_dir_for_bridge_id("bridge_xyz"))
+    assert env["HARNESS_OPENCODE_NATIVE_REQUEST_SESSION_ID"] == "conv_abc"
+
+
+def test_seed_opencode_auth_copies_user_auth(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """The user's auth.json is copied into the per-session XDG_DATA_HOME (0600)."""
+    user_data = tmp_path / "user-share"
+    (user_data / "opencode").mkdir(parents=True)
+    (user_data / "opencode" / "auth.json").write_text('{"anthropic": {"type": "api"}}')
+    monkeypatch.setenv("XDG_DATA_HOME", str(user_data))
+
+    bridge_dir = bridge.prepare_bridge_dir("conv_seed")
+    dest = bridge.seed_opencode_auth(bridge_dir)
+    assert dest is not None and dest.is_file()
+    assert dest == bridge.xdg_data_home_for_bridge_dir(bridge_dir) / "opencode" / "auth.json"
+    assert "anthropic" in dest.read_text()
+    assert (os.stat(dest).st_mode & 0o777) == 0o600
+
+
+def test_seed_opencode_auth_noop_without_source(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """No user auth.json → no-op (returns None), e.g. on a remote runner."""
+    monkeypatch.setenv("XDG_DATA_HOME", str(tmp_path / "empty-share"))
+    bridge_dir = bridge.prepare_bridge_dir("conv_noseed")
+    assert bridge.seed_opencode_auth(bridge_dir) is None
+
+
+def test_user_opencode_config_path_default_location(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Without XDG_CONFIG_HOME, looks at ~/.config/opencode/opencode.jsonc."""
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    fake_home = tmp_path / "fake_home"
+    monkeypatch.setattr(Path, "home", lambda: fake_home)
+    # File does not exist → returns None.
+    assert user_opencode_config_path() is None
+    # Create the file and verify the path is as expected.
+    (fake_home / ".config" / "opencode").mkdir(parents=True)
+    (fake_home / ".config" / "opencode" / "opencode.jsonc").write_text("{}")
+    expected = fake_home / ".config" / "opencode" / "opencode.jsonc"
+    assert user_opencode_config_path() == expected
+
+
+def test_user_opencode_config_path_honors_xdg_config_home(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """XDG_CONFIG_HOME env var redirects the lookup."""
+    cfg_dir = tmp_path / "my-config" / "opencode"
+    cfg_dir.mkdir(parents=True)
+    (cfg_dir / "opencode.jsonc").write_text("{}", encoding="utf-8")
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "my-config"))
+    path = user_opencode_config_path()
+    assert path is not None and path.exists()
+    assert path.name == "opencode.jsonc"
+
+
+def test_user_opencode_config_path_falls_back_to_json(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """When only opencode.json exists (no .jsonc), returns the .json path."""
+    cfg_dir = tmp_path / "cfg" / "opencode"
+    cfg_dir.mkdir(parents=True)
+    (cfg_dir / "opencode.json").write_text("{}", encoding="utf-8")
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "cfg"))
+    path = user_opencode_config_path()
+    assert path is not None and path.name == "opencode.json"
+
+
+def test_user_opencode_config_path_prefers_jsonc(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """When both .jsonc and .json exist, .jsonc is preferred."""
+    cfg_dir = tmp_path / "pref" / "opencode"
+    cfg_dir.mkdir(parents=True)
+    (cfg_dir / "opencode.jsonc").write_text("{}", encoding="utf-8")
+    (cfg_dir / "opencode.json").write_text("{}", encoding="utf-8")
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "pref"))
+    path = user_opencode_config_path()
+    assert path is not None and path.name == "opencode.jsonc"
+
+
+def test_policy_plugin_merges_routing_headers(bridge_dir: Path) -> None:
+    """The generated policy plugin merges OMNIGENT_POLICY_HEADERS into its
+    /policies/evaluate POST.
+
+    The runner bakes the full routing header map (bearer + workspace / deployment
+    selectors) into that env var, so the out-of-process plugin's callbacks reach
+    the same server instance as the runner instead of a different one.
+    """
+    src = write_opencode_policy_plugin(bridge_dir).read_text(encoding="utf-8")
+    assert "OMNIGENT_POLICY_HEADERS" in src
+    # The routing map is spread into the request headers.
+    assert "...POLICY_HEADERS" in src
+    # The old bearer-only env var is fully removed.
+    assert "OMNIGENT_POLICY_AUTH" not in src